Skip virtualenv directories (.venv, venv, env and folders containing pyvenv.cfg) in scan_secrets.py

Add portable scan_secrets.py, pre-commit and CI secret-scan workflow

Add pre-commit config and CI secret scan workflow (detect-secrets)

Detector stack and budget updates

Restore checklist.md to 95% Access Anomaly Detector state

Add PaS CI guard: estimator and PR comment workflow

Harden permission boundary and add scoped test\n\nScope the managed permission boundary to the stack's S3 object ARNs, KMS key ARN and SNS topic ARN and attach it to the detector role via CfnRole override. Add a unit test that asserts the boundary is scoped (to tokens/ARNs, not '*').

Harden permission boundary and add scoped test

cdk: wire alarm actions to SNS alerts topic; add test asserting alarm actions; update checklist

cdk: add error MetricFilter and CloudWatch Alarm; update checklist

s3: add multipart-config S3Adapter, config-driven transfer; strict KMS; pydantic v2 fixes

Amazon IdP

Complete Security Log Ingestion & Tagging section

Complete Project Scaffolding section

First commit